 research-bot
|
63facf9e78
|
updating detection
|
2025-02-20 14:47:35 -08:00 |
|
|
Bhavin Patel
|
a7425f0d4f
|
Update cisco_ai_defense_security_alerts.yml
|
2025-02-19 09:52:08 -08:00 |
|
|
Bhavin Patel
|
44ffd97006
|
typo
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
|
2025-02-18 08:05:35 -08:00 |
|
|
research-bot
|
2933334f4c
|
updaing for validate
|
2025-02-14 13:42:13 -08:00 |
|
|
research-bot
|
9446ac7782
|
updating test
|
2025-02-14 13:07:47 -08:00 |
|
|
research-bot
|
c1a10beef5
|
drafting a search
|
2025-02-14 12:53:18 -08:00 |
|
|
Bhavin Patel
|
e1b7aa4470
|
Merge branch 'develop' into nterl0k-t1200-sysmon-usb-use-execution
|
2025-02-13 08:24:33 -08:00 |
|
|
Bhavin Patel
|
1d30f2f983
|
Merge branch 'develop' into nterl0k-t1200-sysmon-usb-use-execution
|
2025-02-12 12:42:45 -08:00 |
|
|
Steven Dick
|
370db3a337
|
Update and rename windows_detect_wpdbusenum_registry_key_modification.yml to windows_wpdbusenum_registry_key_modification.yml
|
2025-02-12 08:08:54 -05:00 |
|
|
Steven Dick
|
90865c04a3
|
Update and rename windows_detect_usbstor_registry_key_modification.yml to windows_usbstor_registry_key_modification.yml
|
2025-02-12 08:08:19 -05:00 |
|
|
Steven Dick
|
27c097d5de
|
Update and rename windows_detect_process_executed_from_removable_media.yml to windows_process_executed_from_removable_media.yml
|
2025-02-12 08:07:45 -05:00 |
|
|
Steven Dick
|
68d85a24e6
|
Update windows_detect_process_executed_from_removable_media.yml
|
2025-02-12 08:03:17 -05:00 |
|
|
pyth0n1c
|
b9f5735bd3
|
Merge branch 'develop' into remove_type_and_subtype
|
2025-02-11 15:38:08 -08:00 |
|
|
Bhavin Patel
|
471b49044f
|
version
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
|
2025-02-11 10:05:52 -08:00 |
|
|
Bhavin Patel
|
a7cc4a8602
|
Merge branch 'develop' into rdp_brute
|
2025-02-11 10:04:33 -08:00 |
|
|
Bhavin Patel
|
15d12b81ee
|
Update detections/network/windows_remote_desktop_network_bruteforce_attempt.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
|
2025-02-11 10:04:24 -08:00 |
|
|
Bhavin Patel
|
8e0c230a81
|
Update detections/deprecated/remote_desktop_network_bruteforce.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
|
2025-02-11 10:03:58 -08:00 |
|
|
Bhavin Patel
|
f3e0d875e0
|
Merge branch 'develop' into nterl0k-t1114.003-o365-transport-rule-change
|
2025-02-11 08:42:28 -08:00 |
|
|
Bhavin Patel
|
25af0925e6
|
rba message
|
2025-02-11 08:41:18 -08:00 |
|
|
Bhavin Patel
|
0468dff0a3
|
Merge branch 'develop' into analytics_enhancement
|
2025-02-10 14:02:47 -08:00 |
|
|
research-bot
|
15ab58b798
|
updating descirption
|
2025-02-10 14:02:05 -08:00 |
|
|
pyth0n1c
|
45599e0b18
|
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
|
2025-02-10 12:28:22 -08:00 |
|
|
tccontre
|
b09110908d
|
analytics_enhancement
|
2025-02-10 09:43:20 +01:00 |
|
|
tccontre
|
51ae906f15
|
analytics_enhancement
|
2025-02-10 09:39:53 +01:00 |
|
|
tccontre
|
67844bec4e
|
analytics_enhancement
|
2025-02-10 09:36:32 +01:00 |
|
|
Bhavin Patel
|
5ee9bf7d69
|
Merge branch 'develop' into nterl0k-t1213.002-sus-sharepoint-search
|
2025-02-07 10:16:55 -08:00 |
|
|
tccontre
|
1ed454b5bc
|
analytics_enhancement
|
2025-02-07 09:56:32 +01:00 |
|
|
tccontre
|
153871c33f
|
analytics_enhancement
|
2025-02-07 09:53:03 +01:00 |
|
|
tccontre
|
f33a18e9cf
|
analytics_enhancement
|
2025-02-07 09:49:06 +01:00 |
|
|
Br3akp0int
|
abd24d63bc
|
Update windows_security_and_backup_services_stop.yml
|
2025-02-06 18:59:01 +01:00 |
|
|
Br3akp0int
|
636e63d492
|
Update windows_driver_load_non_standard_path.yml
|
2025-02-06 17:42:14 +01:00 |
|
|
Br3akp0int
|
f97787306f
|
Update suspicious_driver_loaded_path.yml
|
2025-02-06 17:02:59 +01:00 |
|
|
Br3akp0int
|
2f48e04006
|
Merge branch 'develop' into analytics_enhancement
|
2025-02-06 16:58:21 +01:00 |
|
|
Steven Dick
|
ef5eca5bd1
|
Update detect_remote_access_software_usage_dns.yml
|
2025-02-06 08:07:31 -05:00 |
|
|
Steven Dick
|
f5160eba6f
|
Update detect_remote_access_software_usage_traffic.yml
|
2025-02-06 08:06:29 -05:00 |
|
|
Steven Dick
|
8d3da80557
|
Update detect_remote_access_software_usage_dns.yml
|
2025-02-06 08:05:27 -05:00 |
|
|
Steven Dick
|
41c92476b9
|
Update detect_remote_access_software_usage_url.yml
|
2025-02-06 08:04:38 -05:00 |
|
|
Steven Dick
|
0885f557bb
|
Update detect_remote_access_software_usage_file.yml
|
2025-02-06 08:03:56 -05:00 |
|
|
Steven Dick
|
f4a78d9f60
|
Update detect_remote_access_software_usage_fileinfo.yml
|
2025-02-06 08:03:25 -05:00 |
|
|
Steven Dick
|
b85aacf75f
|
Update detect_remote_access_software_usage_registry.yml
|
2025-02-06 08:02:38 -05:00 |
|
|
Steven Dick
|
778d7fa7cd
|
Update detect_remote_access_software_usage_process.yml
|
2025-02-06 08:01:53 -05:00 |
|
|
Steven Dick
|
38af78103f
|
Update detect_remote_access_software_usage_fileinfo.yml
|
2025-02-06 08:00:27 -05:00 |
|
|
Steven Dick
|
dea4448a4f
|
Update detect_remote_access_software_usage_file.yml
|
2025-02-06 07:58:47 -05:00 |
|
|
Steven Dick
|
7773664924
|
Update detect_remote_access_software_usage_url.yml
|
2025-02-06 07:57:46 -05:00 |
|
|
Steven Dick
|
2447329ea9
|
Update detect_remote_access_software_usage_dns.yml
|
2025-02-06 07:56:12 -05:00 |
|
|
Steven Dick
|
db40375a6b
|
Update detect_remote_access_software_usage_traffic.yml
|
2025-02-06 07:55:50 -05:00 |
|
|
Steven Dick
|
8b0bf13a10
|
Update detect_remote_access_software_usage_dns.yml
|
2025-02-06 07:53:56 -05:00 |
|
|
Steven Dick
|
988fd0f1e4
|
Update detect_remote_access_software_usage_dns.yml
|
2025-02-06 07:52:12 -05:00 |
|
|
Steven Dick
|
84b5c23db3
|
Merge branch 'splunk:develop' into nterl0k-t1200-sysmon-usb-use-execution
|
2025-02-05 22:44:40 -05:00 |
|
|
Bhavin Patel
|
503a3713af
|
Merge branch 'develop' into rdp_brute
|
2025-02-05 15:41:40 -08:00 |
|